<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Arial;color: #000000;font-size: 10pt;">Steve-
<br>
<br>
I in-lined my answers to your questions. Did the CSV or XLS come through on the list?
<br>
<br>
I am using the CLIP RedHat 6.2 distribution and the versions of the tools that are included with it. I can certainly run any other tools to verify if that will help. As I mentioned, I have emailed the secstate list and they directed me here due to the explanation
of where the problem could exist.<br>
<br>
<span style="color: rgb(128, 128, 128);">> Hello-</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">></span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> Along with the recent release of CLIP, I have begun using SecState to</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> perform auditing and remediation for my system. In performing these tasks</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> and viewing the reports, I found that there were multiple issues with the</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> checks being performed incorrectly.</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> >From the common profile, which is what I am running, I found the following:</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> Check Incorrect (Pre Remediation) 15</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> Check Incorrect (Post Remediation) 15+19 (34)</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">></span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> I have compiled a spreadsheet documenting my findings.</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">></span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> I have contacted the SecState mailing list and I was directed to submit</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> identified errors in the checks to this list. I have attached 2 CSV files</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> containing both the Pre and Post incorrectness as well as the larger XLS</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> spreadsheet.</span><br style="color: rgb(128, 128, 128);">
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">The problem could be in 3 places: the content, openscap, or secstate. Writing</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">good content is hard. Much harder than it should be due to lack of good</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">authoring tools. Perhaps you are on an old version of openscap and these are</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">fixed?</span><br style="color: rgb(128, 128, 128);">
<br style="color: rgb(128, 128, 128);">
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> Please take a look at the findings. If you could provide any detail on the</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> status/state of these issues (are they already known? are these new?)</span><br style="color: rgb(128, 128, 128);">
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">What OS are you using?</span><br style="color: rgb(128, 128, 128);">
<div style="margin-left: 40px; color: rgb(128, 128, 128);"><span style="color: rgb(0, 0, 0);">RedHat 6.2 from the CLIP release</span><br>
</div>
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">What version of openscap?</span><br style="color: rgb(128, 128, 128);">
<div style="margin-left: 40px; color: rgb(128, 128, 128);"><span style="color: rgb(0, 0, 0);">0.9.1-1</span><br>
</div>
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">What version of secstate?</span><br style="color: rgb(128, 128, 128);">
<div style="margin-left: 40px; color: rgb(128, 128, 128);"><span style="color: rgb(0, 0, 0);">0.6.0</span><br>
</div>
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">What content and its version number?</span><br style="color: rgb(128, 128, 128);">
<div style="margin-left: 40px; color: rgb(128, 128, 128);"><span style="color: rgb(0, 0, 0);">SSG content ssg-rhel6-xccdf.xml</span><br>
</div>
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">Without any of these its hard to reproduce.</span><br style="color: rgb(128, 128, 128);">
<br style="color: rgb(128, 128, 128);">
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> and/or the planned date of future release that may include any fixes, it</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> would be much appreciated. Additionally, if there is a single point of</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">> contact appropriate to work with on this, that information would be useful.</span><br style="color: rgb(128, 128, 128);">
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">This is the openscap list which provides its own security scanner, oscap. You</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">may be asked to reproduce the problem using the oscap utility to see if there</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">is still a problem. But lets start with just letting us know the versions of</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">the different pieces.</span><br style="color: rgb(128, 128, 128);">
<br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">Thanks,</span><br style="color: rgb(128, 128, 128);">
<span style="color: rgb(128, 128, 128);">-Steve</span><br>
</div>
</body>
</html>